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Amendments to the Claims : 

This listing of claims replaces all prior versions and listings of claims in the application: 
Listing of Claims : 

1 . (Currently Amended) A method for real-time measurement of the performance of 
communications on a large area network between a selected server and a plurality of users at 
client machines, based upon actual user experience, including: 

accessing a server log having user-interaction records indicative of user 
interactions that occur with one or more applications running on the selected server and that are 
carried on communications associated with routings through nodes of the network of actual user 
acc e ss to th e s e l e ct e d s e rver ; 

determining from the records, assessments of the performance of the 
communications experienced by the plurality of users; 

determining correlations between the assessments of the performance and the 
routings of the communications; and 

based on the correlations, modifying one or more of the routings to improve the 

performance. 

f i lt e ring ou t se lect e d records from th e server log, wh e r e in the filt e ring r e mov e s 
th e s e l e ct e d r e cord s from furth e r consid e ration; 

aggr e gating r e cords from th e s e rv e r log into a plurality of aggregate slot s , each 
slot having at least on e tim e bin whiph repres e nts an int e rval of time, based on an aggr e gation 

p e rforming at l e ast on e s tatistical analysi s s e parat e ly on e ach time bin of each 
aggr e gat e slot; and 

outputting the results of such statistical analysis as an indication of actual acc e ss 
to serv e r usage by us e rs. 
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2. (Previously Presented) The method of claim 1 , wherein at least one of the nodes is 
part of a communication path connecting one of the client machines to the selected server. 

3. (Original) The method of claim 1 , further including generating an event 
notification if a selected statistical analysis value is abnormal. 

4. (Currently Amended) The method of claim 1 , further including selecting [[the]] 
an aggregation method from a set of aggregation methods for aggregating the user-interaction 
records according to a parameter . 

5. (Currently Amended) The method of claim [[1]] 4, wherein the aggregation 
method includes aggregation by log-file record column data value for each record from the 
server log. 

6-10. (Canceled) 

1 1 . (Currently Amended) A system for real-time measurement of the performance of 
communications on a large area network between a selected server and a plurality of users at 
client machines, based upon actual user experience, including: 

a server log having user-interaction records with data indicative of user 
interactions that occur with one or more applications running on the selected server and that are 
carried on communications associated with routings through nodes of the network of actual us e r 
acc es s to th e s e lected server ; 

one or more processors configured to 

determine from the records, assessments of the performance of the 
communications experienced by the plurality of users: 

determine correlations between the assessments and the routings: and 
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based on the correlations, generate a command for modifying one or more 
of the routings to improve the performance. 

means for filt e ring out s e l e ct e d r e cords from th e server log, wh e r e in th e m e ans for 
filt e ring r e mov e s the sel e ct e d r e cords from further consid e ration; 

moans for accessing and aggr e gating records from the serv e r log into a plurality 
of aggr e gate slots, e ach having at l e ast ono tim e bin which represent s an interval of tim e , based 
on an aggregation method; 

m e ans for p e rforming - at - l e ast one statistical analysis of eaoh tim e b e ing of each 
aggregate slot; and 

moans for outputting th e results of such stati s tical analysis as an indication of 
access to actual s e rver usag e by us e rs . 

12. (Previously Presented) The system of claim 1 1 , wherein at least one of the nodes 
is part of a communication path connecting one of the client machines to the selected server. 

13. (Original) The system of claim 1 1, further including means for generating an 
event notification if a selected statistical analysis value is abnormal. 

1 4. (Currently Amended) The system of claim 1 1 , further including means for 
selecting [[the]] an aggregation method from a set of aggregation methods for aggregating the 
user-interaction records according to a parameter . 

1 5 . (Currently Amended) The system of claim [[ 1 1 ]] 14, wherein the aggregation 
method includes aggregation by log-file record column data value for each record from the 
server log. 



16-20. (Canceled) 
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2 1 . (Currently Amended) A computer program, stored on a tangible computer- 
readable medium, for real-time measurement of the performance of communications on a large 
area network between a selected server and a plurality of users at client machines, based upon 
actual user experience, the computer program comprising instructions for causing a computer 
system to: 

access a server log having user-interaction records indicative of user interactions 
that occur with one or more applications running on the selected server and that are carried on 
communications associated with routings through nodes of the network of actual user access to 
the selected s e rv e r ; 

determine from the records, assessments of the performance of the 
communications experienced by the plurality of users; 

determine correlations between the assessments and the routings; and 

based on the correlations, modify one or more of the routings to improve the 

performance. 

filter out selected r e cords from the server log, wher e in th e s e l e ct e d r e cords are 
remov e d from furth e r consideration; 

aggr e gat e r e cords from th e s e rver log into a plurality of aggr e gat e slots, e ach 
having at least on e tim e bin, based on an aggregation m e thod; 

p e rform at l e ast on e statistical analysis of e ach tim e bin, r e pr e s e nting a tim e 
int e rval, of each aggr e gat e slot; and 

output th e r e sults of each statistical analysis a s an indication of actual s e rver 

usago by users. 

22. (Previously Presented) The computer program of claim 2 1 , wherein at least one of 
the nodes is part of a communication path connecting one of the client machines to the selected 
server. 
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23. (Original) The computer program of claim 21, further including instructions for 
causing the computer system to generate an event notification if a selected statistical analysis 
value is abnormal. 

24. (Currently Amended) The computer program of claim 21 , further including 
instructions for causing the computer system to select [[the]] an aggregation method from a set 
of aggregation methods for aggregating the user-interaction records according to a parameter . 

25. (Currently Amended) The computer program of claim [[21]] 24, wherein the 
aggregation method includes aggregation by log-file record column data for each record from the 
server log. 

26 - 30. (Canceled) 

3 1 . (Currently Amended) A method as in claim 1, wherein determining assessments 
comprises applying a [[said]] statistical analysis that determines time for specified user access 
relative to a specified interval, and sorts said user access according to a number of times that the 
application exceeds said interval. 

32. (Previously Presented) A method as in claim 1, wherein said server log includes a 
time stamp indicating when a record was formed, a client IP address, a time taken to complete 
transmission, and a size of the transmission. 

33. (Currently Amended) A method as in claim 32, wherein said server log is formed 
by adding new data entry to the server log, and said server log is closed to further data entry prior 
to said [[performing]] determining assessments of the performance of the communications . 
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34. (Currently Amended) A method as in claim 32, whoroin said aggregating 
comprises farther comprising determining a geographic location from the IP address, and 
aggregating IP addresses having a specified relationship with a specified geographical location. 

35. (Previously Presented) A method as in claim 32, further comprising aggregating 
said time bins into chronological order and determining trends among said time bins. 

36. (Currently Amended) A method as in claim 32, furth e r comprising wherein 
determining assessments of the performance of the communications comprises determining ttsmg 
said information to a computer byte density, transfer fate, and error fraction. 

37. (Currently Amended) A method as in claim 32, wherein determining correlations 
comprise applying a [[said]] statistical analysis is an ass e ssm e nt of to assess a performance 
related measurement against a geographical location of a client. 

38. (Currently Amended) A method as in claim 32, wherein determining correlations 
comprise applying a [[said]] statistical analysis is an assessm e nt of to assess a route traversed 
during use of the network application one or more applications by an end user. 

39. (Currently Amended) A method as in claim 1 , wherein modifying one or more of 
the routings further comprises furth e r comprising determining a new [[path]] routing bas e d on 
said r e sults of said statistical analysis . 

40. (Previously Presented) A system as in claim 1 1 , wherein said server log includes a 
time stamp indicating when a record was formed, a client IP address, a time taken to complete 
transmission, and a size of the transmission. 
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41 . (Currently Amended) A system as in claim 40, wherein said server log is formed 
by added new data as entries to the server log, and said server log is closed to further data entry 
prior to said performing determining assessments . 

42. (Currently Amended) A system as in claim 40, wherein said accessing means one 
or more processors converts the IP address into a geographical location, and aggregates TP 
addresses having a specified relationship with a specified geographical location. 

43. (Previously Presented) A system as in claim 40, wherein said statistical analysis is 
an assessment of performance related measurement against a geographical location of a client. 

44. (Currently Amended) A system as in claim 40, wherein said statistical analysis is 
the one or more processors are configured to determine an assessment of a route traversed during 
use of the network application one or more applications by an end user. 

45. (Currently Amended) A system as in claim 1 1 , further comprising a 
communication routing part, determining a new routing path bas e d on said r e sults of said 
statistical analysis . 

46. (Previously Presented) The computer program as in claim 2 1 , wherein said 
instructions to access the server log comprises instructions to access a server log that includes 
time information about records, client DP address, time taken to compete a transmission, and a 
size of the transmission. 



47. (Currently Amended) The computer program as in claim 46, further comprising 
wh e r e in said instructions to aggr e gat e includ e instructions to convert the IP address into 
information indicative of a geographical location, and to aggregate the information according to 
the geographical location. 
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48. (Currently Amended) The computer program as in claim 47, further comprising 



performance versus geographical location of the client. 

49. (Currently Amended) The computer program as in claim 47, further comprising 
whoroin said instructions to perform a statistical analysis perform th e a statistical analysis 
assessing a route traversed during a network application. 

50. (Currently Amended) The computer program as in claim 2 1 further comprising 
additional instructions to determine a new routing path based on results of said statistical 

5 1 . (Currently Amended) The method of claim 34, wherein determining a geographic 
location g e ographical or sourc e information for each r e cord includes: 

defining a database comprising large area network address blocks having geographical or 
source information; 

comparing an address field in each record to the address blocks in the database; and 
associating with each record the geographical or source information from an address 
block matching the address field of the record. 

52. (Previously Presented) The method of claim 5 1 , wherein comparing an address 
field in each record to the address blocks in the database includes: 

defining an array of binary trees for the address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value; 

masking each address field in each record by a unique subnet value corresponding to a 
selected array element; 



wherein said instructions to perform 




a statistical analysis of 
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comparing each masked address field to an address field of the address blocks within the 
binary tree of the selected array element; 

outputting selected fields of any matching address block; and 

otherwise, continuing the step of comparing with a next selected array element until a 
match is found or all array elements have been compared. 

53. (Currently Amended) The method of claim 1 , further including: 
determining exit routing paths from each selected server based on the records from the 

server log; 

determining a best performing exit route based on [[the]] a statistical analysis of records 
from the server log; 

biasing incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 

54. (Currently Amended) The system of claim 1 1 , further comprising: 
means for determining geographical or source information for each record; and 
means for selecting [[the]] an aggregation method to aggregate records based on such 

geographical or source information. 

55. (Previously Presented) The system of claim 54, wherein the means for 
determining geographical or source information for each record includes: 

a database comprising large area network address blocks having geographical or source 
information; 

a comparison function for comparing an address field in each record to the address blocks 
in the database; and 

an associating function for associating with each record the geographical or source 
information from an address block matching the address field of the record. 
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56. (Previously Presented) The system of claim 55, wherein the comparison function 
includes: 

an array of binary trees from the address blocks in the database, each address block 
within a binary tree within an array element being masked by a corresponding unique subnet 
mask value; 

means for masking each address field in each record by a unique subnet value 
corresponding to a selected array element; 

means for comparing each masked address field to an address field of the address bocks 
within the binary tree of the selected array element; 

means for outputting selected fields of any matching address block ;and 

means for otherwise continuing the step of comparing with a next selected array element 
until match is found or all array elements have been compared. 

57. (Currently Amended) The system of claim 1 1 , further including: 

means for determining exit routing paths for each selected server based on the records 
from the server log; 

means for determining a best performing exit route based on [[the]] a statistical analysis 
of records from the server log; 

means for biasing incoming and outgoing communications with respect to each server to 
use the determined best performing exit route. 

5 8 . (Currently Amended) The computer program of claim 2 1 , further including 

instructions for causing the computer system to: 

determine geographical or source information for each record; and 

select [[the]] an aggregation method to aggregate records based on such geographical or 

source information. 
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59. (Previously Presented) The computer program of claim 58, wherein the 
instructions for causing the computer systems to determine geographical or source information 
for each record further include instructions for causing the computer system to: 

define a database comprising large area network address blocks having geographical or 
source information; 

compare an address field in each record to the address blocks in the database; and 
associate with each record the geographical or source information from an address block 
matching the address field of the record. 

60. (Previously Presented) The computer program of claim 59, wherein the 
instructions for causing the computer system to compare an address field in each record to the 
address blocks in the database include instructions for causing the computer system to: 

define an array of binary trees for the address blocks in the database, each address block 
within a binary tree within an array element being masked by a corresponding unique subnet 
mask value; 

make each address field in each record by a unique subnet value corresponding to a 
selected array element; 

compare each masked address field to an address field of the address blocks within the 
binary tree of the selected array element; 

output selected fields of any matching address block; and 

otherwise, continue the step of comparing with a next selected array element until a 
match is found or all array elements have been compared. 

6 1 . (Currently Amended) The computer program of claim 2 1 , further including 
instructions for causing the computer system to: 

determine exit routing paths from each selected server based on the records from the 
server log; 
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determine a best performing exit route based on [[the]] a statistical analysis of records 
from the server log; 

bias incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 

62. (New) The method of claim 1 , wherein determining assessments further 
comprises: 

filtering out selected records from the server log, wherein the filtering removes the 
selected records from further consideration; 

aggregating records from the server log into a plurality of aggregate slots, each slot 
having at least one time bin which represents an interval of time, based on an aggregation 
method; 

performing at least one statistical analysis separately on each time bin of each aggregate 
slot; and 

outputting the results of such statistical analysis as an indication of actual access-to- 
server usage by users. 

63. (New) The system of claim 1 1, wherein the one or more processors are further 
configured to: 

filter out selected records from the server log, wherein the selected records are removed 
from further consideration; 

aggregate records from the server log into a plurality of aggregate slots, each having at 
least one time bin, based on an aggregation method; 

perform at least one statistical analysis of each time bin, representing a time interval, of 
each aggregate slot; and 

output the results of each statistical analysis as an indication of actual server usage by 

users. 
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64. (New) The computer program of claim 21, further including instructions for 
causing the computer system to: 

filter out selected records from the server log, wherein the selected records are removed 
from further consideration; 

aggregate records from the server log into a plurality of aggregate slots, each having at 
least one time bin, based on an aggregation method; 

perform at least one statistical analysis of each time bin, representing a time interval, of 
each aggregate slot; and 

output the results of each statistical analysis as an indication of actual server usage by 

users. 



